The Istanbul Metropolitan Municipality (IMM) suffered a massive data breach involving its Istanbul Senin municipal application, where personal data and location information of 4.7 million users were unlawfully transferred to two foreign countries. Additionally, 3.7 million users' data was listed for sale on the dark web. Investigations revealed further breaches, including the unauthorized processing and disclosure of ballot box data for 11 million citizens via a sub-application (IMM Hanem). The breach was linked to an alleged criminal enterprise involving 15 detained suspects, including administrators from six IMM-affiliated companies. The incident exposed systemic vulnerabilities, with data exploited for fraudulent activities, dark web sales, and potential political manipulation. The breach not only compromised user privacy but also eroded public trust in municipal digital services, with ongoing legal and reputational fallout.